diff --git a/cmds/portmaster-core/main.go b/cmds/portmaster-core/main.go
index 630f5827..7a5dc5a2 100644
--- a/cmds/portmaster-core/main.go
+++ b/cmds/portmaster-core/main.go
@@ -33,13 +33,15 @@ func init() {
 }
 
 func main() {
+	flag.Parse()
+	// Call platform specific checks, that will execute commands like "recover-iptables"
+	platformSpecificChecks()
+
 	instance := initialize()
 	run(instance)
 }
 
 func initialize() *service.Instance {
-	flag.Parse()
-
 	// set information
 	info.Set("Portmaster", "", "GPLv3")
 
diff --git a/cmds/portmaster-core/main_linux.go b/cmds/portmaster-core/main_linux.go
index e0145822..8c7cc369 100644
--- a/cmds/portmaster-core/main_linux.go
+++ b/cmds/portmaster-core/main_linux.go
@@ -144,3 +144,17 @@ func isRunningAsService() bool {
 	// Check if the parent process ID is 1 == init system
 	return ppid == 1
 }
+
+func platformSpecificChecks() {
+	// If flag is set. Run recover IP tables and exit. (Can be true only on linux)
+	if recoverIPTables {
+		exitCode := 0
+		err := recoverIPTablesCmd()
+		if err != nil {
+			fmt.Printf("failed: %s", err)
+			exitCode = 1
+		}
+
+		os.Exit(exitCode)
+	}
+}
diff --git a/cmds/portmaster-core/main_windows.go b/cmds/portmaster-core/main_windows.go
index 7cd1c5bf..63cc22ff 100644
--- a/cmds/portmaster-core/main_windows.go
+++ b/cmds/portmaster-core/main_windows.go
@@ -171,3 +171,5 @@ sc.exe start $serviceName`
 
 	return nil
 }
+
+func platformSpecificChecks() {}
diff --git a/cmds/portmaster-core/recover_linux.go b/cmds/portmaster-core/recover_linux.go
new file mode 100644
index 00000000..f13e5986
--- /dev/null
+++ b/cmds/portmaster-core/recover_linux.go
@@ -0,0 +1,83 @@
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/safing/portmaster/service/firewall/interception"
+)
+
+var recoverIPTables bool
+
+func init() {
+	flag.BoolVar(&recoverIPTables, "recover-iptables", false, "recovers ip table rules")
+}
+
+func recoverIPTablesCmd() error {
+	// interception.DeactiveNfqueueFirewall uses coreos/go-iptables
+	// which shells out to the /sbin/iptables binary. As a result,
+	// we don't get the errno of the actual error and need to parse the
+	// output instead. Make sure it's always english by setting LC_ALL=C
+	currentLocale := os.Getenv("LC_ALL")
+	_ = os.Setenv("LC_ALL", "C")
+	defer func() {
+		_ = os.Setenv("LC_ALL", currentLocale)
+	}()
+
+	err := interception.DeactivateNfqueueFirewall()
+	if err == nil {
+		return nil
+	}
+
+	// we don't want to show ErrNotExists to the user
+	// as that only means portmaster did the cleanup itself.
+	var mr *multierror.Error
+	if !errors.As(err, &mr) {
+		return err
+	}
+
+	var filteredErrors *multierror.Error
+	for _, err := range mr.Errors {
+		// if we have a permission denied error, all errors will be the same
+		if strings.Contains(err.Error(), "Permission denied") {
+			return fmt.Errorf("failed to cleanup iptables: %w", os.ErrPermission)
+		}
+
+		if !strings.Contains(err.Error(), "No such file or directory") {
+			filteredErrors = multierror.Append(filteredErrors, err)
+		}
+	}
+
+	if filteredErrors != nil {
+		filteredErrors.ErrorFormat = formatNfqErrors
+		return filteredErrors.ErrorOrNil()
+	}
+
+	return nil
+}
+
+// func init() {
+// 	rootCmd.AddCommand(recoverIPTablesCmd)
+// }
+
+func formatNfqErrors(es []error) string {
+	if len(es) == 1 {
+		return fmt.Sprintf("1 error occurred:\n\t* %s\n\n", es[0])
+	}
+
+	points := make([]string, len(es))
+	for i, err := range es {
+		// only display the very first line of each error
+		first := strings.Split(err.Error(), "\n")[0]
+		points[i] = fmt.Sprintf("* %s", first)
+	}
+
+	return fmt.Sprintf(
+		"%d errors occurred:\n\t%s\n\n",
+		len(es), strings.Join(points, "\n\t"))
+}